TI-2026-24392 Aliases CVE-2026-31839 GHSA-mmf8-487q-p45m

Striae has a hash validation utility vulnerability

LOW 35CWE-354Published 2026-03-11 · Updated 2026-03-11

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-327.

Summary

Striae is a firearms examiner's comparison companion. A high-severity integrity bypass vulnerability existed in Striae's digital confirmation workflow prior to v3.0.0. Hash-only validation trusted manifest hash fields that could be modified together with package content, allowing tampered confirmation packages to pass integrity checks. This vulnerability is fixed in 3.0.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00141 3rd percentileScored 2026-11-07

Fix Fixed striae (striae-org): 3.0.0@striae-org/striae (npm): 3.0.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
striae-org	striae	0.9.22-0 to before 3.0.0	3.0.0	Patch available	CNA
—	@striae-org/striae (npm)	0.9.22-0 to before 3.0.0	3.0.0	Patch available	GHSA-mmf8-487q-p45m

striae Vendorstriae-org Affected 0.9.22-0 to before 3.0.0 Fixed in 3.0.0 Patch available CNA
@striae-org/striae (npm) Vendor— Affected 0.9.22-0 to before 3.0.0 Fixed in 3.0.0 Patch available GHSA-mmf8-487q-p45m

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:striae:striae::::::node.js::*	0.9.22 – 3.0.0	Vulnerable	Striae

cpe:2.3:a:striae:striae:*:*:*:*:*:node.js:*:* Versions 0.9.22 – 3.0.0 Vulnerable ·Striae

Remediation

Fix · CNA striae (striae-org) Fixed in 3.0.0
Fix · GHSA-mmf8-487q-p45m @striae-org/striae (npm) Fixed in 3.0.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2026-31839
2026-10-03 Alias added: GHSA-mmf8-487q-p45m

References

Advisory 2

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences